A flaw in the Lenovo Legion Zone application allows an attacker on the same logical network to trigger deserialization of untrusted data, leading to arbitrary code execution. This vulnerability, classified as CWE‑502, can compromise the host running the application, resulting in loss of confidentiality, integrity, and availability for that device.

The Lenovo Legion Zone application, sold exclusively for the Chinese market, is affected. No specific vulnerable versions are listed, but Lenovo recommends upgrading to version 2.0.28.8182 or later to eliminate the flaw.

The CVSS score of 8.6 indicates high severity; the EPSS score of 0.00264, or less than 1%, indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the combination of remote code execution capability and requirement that the attacker be on the same logical network makes it a significant threat. An attacker who can reach the application can deliver malicious payloads and execute code at the privilege level of the application process.